Add signing hooks for observing signature attempts and implementing restartable signing

[hanno-becker]

• Based on common: Split context-parameter machinery into context.h #1238

sign: Add configurable signing hooks (resume/attempt/finish)

The runtime of ML-DSA signatures is theoretically unbounded. Even the
bound of max 814 signature attempts -- approved by NIST as lowering the
chance of signing failure below 2^{-256} -- leaves a performance distribution
whose peak percentiles can be unacceptable for constrained systems with
strict timing requirements.

As a remedy, the library already provides a configuration option
MLD_CONFIG_MAX_SIGNING_ATTEMPTS to limit the number of signing attempts.
However, FIPS 204 explicitly forbids lowering the number of signing attempts
below 814, rendering the use of this option in constrained environments
non-compliant.

As a remedy, this commit introduces a facility for _restartable signing_:
In addition to using MLD_CONFIG_MAX_SIGNING_ATTEMPTS, the user can provide
a custom hook for remembering the last signing attempt, and continuing the
next signing call at that point.

More specifically, the idea is to introduce three 'signing hooks'
into the core signature routine:
- `nonce = sign_resume()`: Return the nonce corresponding to the next
  signing attempt. `0` for an initial / non-restartable signing
  operation.
- `sign_attempt(nonce)`: Note the nonce for the next signing attempt.
- `sign_finish(nonce)`: Note the nonce for which signing succeeded.

Here, only `sign_resume()` affects the signing process functionally,
while `sign_attempt()` and `sign_finish()` are passive logging operations.

This approach to restartable signing only works if the consumer works
directly with the internal signing API. If they use the randomized API,
a fresh seed would be chosen even on supposedly restarted signing operations,
leading to non-compliant signatures. The use of a `sign_resume()` hook
is therefore only safe with MLD_CONFIG_NO_RANDOMIZED_API.

In contrast, `sign_attempt` and `sign_finish` are passive, and can safely
be used on their own with any configuration. Indeed, these hooks serve
other uses outside of restartable signing:
- sign_attempt can be used to get finer-grained benchmarks for individual
  signing attempts
- sign_finish can be used to log the number of signing attempts, which
  can be useful again for benchmarking, or for checking the expected
  distribution of signing attempts.

Finally, sign_{resume|attempt|finish} can all be implemented based on
mutable globals, or based on a context. It therefore makes sense to
introduce them under the existing MLD_CONFIG_CONTEXT_PARAMETER
wrapper, which allows functions to be called with or without an
application-specific context pointer.

Taking all these considerations together, here's what the commit changes:

- Add independent MLD_CONFIG_SIGN_HOOK_{RESUME|FINISH|ATTEMPT} configuration
  options for registering signing hooks as above. When set, the user provides
  the following functions, respectively:

  - `nonce = mld_sign_resume([ctx])`: Provide initial or resuming nonce
  - `mld_sign_attempt(nonce [, ctx])`: Log/remember nonce for next attempt
  - `mld_sign_finish(nonce [, ctx])`: Log/remember nonce for successful attempt

- The option can be used with or without MLD_CONFIG_CONTEXT_PARAMETER. If the
  latter is set, the user-provided context will be passed to `mld_sign_xxx`
  as the last argument.

- An example is added illustrating the use of the hooks to implement restartable
  signing.

Note: A consumer might want to use restartable signing with randomized APIs.
This is not natively supported. However, it is expected to be easily implementable
since the components required to build randomized signing from deterministic
signing are all public. Note that resuming additionally requires the consumer
to hold the signing randomness `rnd` fixed across the resumed calls.

[oqs-bot]

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (206 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1363s	1398s	-2.5%
polyvec_matrix_pointwise_montgomery_yvec	✅	137s	144s	-5%
poly_pointwise_montgomery_c	✅	117s	118s	-1%
mld_invntt_layer	✅	98s	110s	-11%
polyveck_chknorm	✅	59s	65s	-9%
sign_verify_internal	✅	49s	53s	-8%
fqmul	✅	43s	40s	+7%
mld_ntt_layer	✅	43s	44s	-2%
mld_attempt_signature_generation	✅	28s	24s	+17%
keccakf1600x4_permute_native	✅	22s	21s	+5%
mld_ntt_butterfly_block	✅	21s	22s	-5%
poly_ntt_c	✅	21s	21s	+0%
mld_check_pct	✅	15s	10s	+50%
polyeta_unpack	✅	13s	13s	+0%
polyt0_unpack	✅	13s	13s	+0%
rej_uniform_c	✅	13s	18s	-28%
compute_pack_t0_t1	✅	12s	11s	+9%
poly_chknorm_c	✅	12s	11s	+9%
poly_invntt_tomont_c	✅	12s	12s	+0%
poly_uniform_eta_4x	✅	11s	14s	-21%
polyvecl_chknorm	✅	9s	11s	-18%
rej_uniform	✅	9s	8s	+12%
keccak_absorb_once_x4	✅	8s	10s	-20%
polyz_unpack_c	✅	7s	9s	-22%
sign_signature_extmu	✅	7s	4s	+75%
keccak_f1600_x1_native_aarch64	✅	6s	3s	+100%
mld_compute_pack_z	✅	6s	7s	-14%
mld_keccakf1600_permute_c	✅	6s	5s	+20%
mld_sample_s1_s2	✅	6s	3s	+100%
mld_sample_s1_s2_serial	✅	6s	4s	+50%
poly_add	✅	6s	5s	+20%
polyvec_matrix_pointwise_montgomery_row	✅	6s	8s	-25%
polyveck_decompose	✅	6s	8s	-25%
rej_eta_native	✅	6s	5s	+20%
sign_pk_from_sk	✅	6s	7s	-14%
sign_signature	✅	6s	3s	+100%
sign_signature_pre_hash_internal	✅	6s	6s	+0%
fqscale	✅	5s	3s	+67%
keccak_absorb	✅	5s	3s	+67%
keccak_finalize	✅	5s	6s	-17%
ntt_native_aarch64	✅	5s	3s	+67%
poly_caddq_native	✅	5s	4s	+25%
poly_challenge	✅	5s	2s	+150%
poly_decompose	✅	5s	3s	+67%
poly_decompose_c	✅	5s	6s	-17%
poly_ntt_native	✅	5s	4s	+25%
poly_reduce	✅	5s	6s	-17%
poly_uniform	✅	5s	6s	-17%
polyveck_reduce	✅	5s	6s	-17%
polyvecl_ntt	✅	5s	3s	+67%
rej_uniform_native	✅	5s	6s	-17%
sign_keypair	✅	5s	3s	+67%
sign_signature_pre_hash_shake256	✅	5s	3s	+67%
sk_s2hat_get_poly	✅	5s	2s	+150%
decompose	✅	4s	3s	+33%
intt_native_aarch64	✅	4s	4s	+0%
keccak_init	✅	4s	2s	+100%
keccak_squeezeblocks_x4	✅	4s	5s	-20%
keccakf1600_permute_native	✅	4s	2s	+100%
keccakf1600_xor_bytes	✅	4s	2s	+100%
mld_polymat_expand_entry	✅	4s	2s	+100%
mld_value_barrier_u32	✅	4s	3s	+33%
mld_value_barrier_u8	✅	4s	3s	+33%
pointwise_acc_native_aarch64	✅	4s	6s	-33%
pointwise_acc_native_x86_64	✅	4s	7s	-43%
pointwise_native_aarch64	✅	4s	4s	+0%
poly_caddq_c	✅	4s	3s	+33%
poly_permute_bitrev_to_custom_optional_native	✅	4s	2s	+100%
poly_power2round	✅	4s	5s	-20%
poly_shiftl	✅	4s	3s	+33%
poly_uniform_gamma1_4x	✅	4s	3s	+33%
poly_use_hint_c	✅	4s	3s	+33%
poly_use_hint_native_aarch64	✅	4s	5s	-20%
polyt1_pack	✅	4s	1s	+300%
polyvec_matrix_expand_serial	✅	4s	2s	+100%
polyveck_caddq	✅	4s	4s	+0%
polyveck_pack_eta	✅	4s	4s	+0%
polyveck_pack_w1	✅	4s	3s	+33%
polyveck_unpack_eta	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery_c	✅	4s	4s	+0%
polyvecl_uniform_gamma1	✅	4s	3s	+33%
polyz_unpack_native	✅	4s	2s	+100%
rej_uniform_eta_native_aarch64	✅	4s	3s	+33%
shake256_finalize	✅	4s	2s	+100%
shake256_squeeze	✅	4s	2s	+100%
sig_unpack_hints	✅	4s	3s	+33%
sign_signature_internal	✅	4s	3s	+33%
sign_verify	✅	4s	5s	-20%
sign_verify_extmu	✅	4s	3s	+33%
sign_verify_pre_hash_shake256	✅	4s	3s	+33%
sk_t0hat_get_poly	✅	4s	2s	+100%
unpack_sk	✅	4s	2s	+100%
yvec_get_poly	✅	4s	4s	+0%
intt_native_x86_64	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	3s	+0%
keccak_f1600_x4_native_avx2	✅	3s	3s	+0%
keccakf1600x4_extract_bytes	✅	3s	3s	+0%
keccakf1600x4_permute	✅	3s	2s	+50%
make_hint	✅	3s	3s	+0%
mld_ct_abs_i32	✅	3s	1s	+200%
mld_ct_cmask_neg_i32	✅	3s	4s	-25%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_ct_get_optblocker_i64	✅	3s	4s	-25%
mld_ct_get_optblocker_u32	✅	3s	1s	+200%
mld_keccakf1600_extract_bytes	✅	3s	3s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	3s	3s	+0%
mld_prepare_domain_separation_prefix	✅	3s	5s	-40%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_i64	✅	3s	3s	+0%
montgomery_reduce	✅	3s	4s	-25%
ntt_native_x86_64	✅	3s	4s	-25%
nttunpack_native_x86_64	✅	3s	3s	+0%
pack_sig_c	✅	3s	3s	+0%
pack_sig_h	✅	3s	6s	-50%
pack_sk_rho_key_tr_s2	✅	3s	4s	-25%
poly_caddq_native_aarch64	✅	3s	2s	+50%
poly_chknorm_native_aarch64	✅	3s	3s	+0%
poly_decompose_88_native_aarch64	✅	3s	2s	+50%
poly_decompose_native	✅	3s	4s	-25%
poly_invntt_tomont	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional	✅	3s	3s	+0%
poly_pointwise_montgomery_native	✅	3s	2s	+50%
poly_uniform_eta	✅	3s	3s	+0%
polyeta_pack	✅	3s	1s	+200%
polyt0_pack	✅	3s	3s	+0%
polyt1_unpack	✅	3s	4s	-25%
polyvec_matrix_expand	✅	3s	4s	-25%
polyveck_invntt_tomont	✅	3s	5s	-40%
polyvecl_pack_eta	✅	3s	3s	+0%
polyvecl_uniform_gamma1_serial	✅	3s	3s	+0%
polyvecl_unpack_eta	✅	3s	2s	+50%
polyvecl_unpack_z	✅	3s	4s	-25%
polyz_pack	✅	3s	2s	+50%
polyz_unpack	✅	3s	4s	-25%
polyz_unpack_native_x86_64	✅	3s	4s	-25%
reduce32	✅	3s	4s	-25%
rej_eta_c	✅	3s	3s	+0%
shake128_absorb	✅	3s	4s	-25%
shake128_squeeze	✅	3s	3s	+0%
shake256_release	✅	3s	2s	+50%
shake256x4_squeezeblocks	✅	3s	2s	+50%
sign_keypair_internal	✅	3s	3s	+0%
sign_verify_pre_hash_internal	✅	3s	5s	-40%
sk_s1hat_get_poly	✅	3s	5s	-40%
unpack_pk_t1	✅	3s	3s	+0%
unpack_sk_s1hat	✅	3s	2s	+50%
use_hint	✅	3s	2s	+50%
yvec_init	✅	3s	2s	+50%
caddq	✅	2s	1s	+100%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	2s	+0%
keccak_squeeze	✅	2s	5s	-60%
keccakf1600_permute	✅	2s	2s	+0%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u32	✅	2s	1s	+100%
mld_ct_get_optblocker_u8	✅	2s	4s	-50%
mld_ct_memcmp	✅	2s	4s	-50%
mld_h	✅	2s	7s	-71%
mld_keccakf1600x4_extract_bytes_c	✅	2s	3s	-33%
mld_sign_attempt	✅	2s	-	new
mld_sign_resume	✅	2s	-	new
pack_sig_z	✅	2s	3s	-33%
pack_sk_s1	✅	2s	2s	+0%
pointwise_native_x86_64	✅	2s	2s	+0%
poly_caddq	✅	2s	3s	-33%
poly_caddq_native_x86_64	✅	2s	3s	-33%
poly_chknorm	✅	2s	4s	-50%
poly_chknorm_native	✅	2s	2s	+0%
poly_chknorm_native_x86_64	✅	2s	4s	-50%
poly_decompose_32_native_aarch64	✅	2s	4s	-50%
poly_invntt_tomont_native	✅	2s	4s	-50%
poly_ntt	✅	2s	3s	-33%
poly_sub	✅	2s	4s	-50%
poly_use_hint_native	✅	2s	3s	-33%
polyveck_ntt	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery	✅	2s	3s	-33%
polyvecl_pointwise_acc_montgomery_native	✅	2s	4s	-50%
polyw1_pack	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	2s	+0%
polyz_unpack_17_native_aarch64	✅	2s	3s	-33%
polyz_unpack_19_native_aarch64	✅	2s	3s	-33%
power2round	✅	2s	3s	-33%
rej_eta	✅	2s	2s	+0%
rej_uniform_native_aarch64	✅	2s	3s	-33%
shake128_finalize	✅	2s	5s	-60%
shake128_init	✅	2s	1s	+100%
shake128_release	✅	2s	3s	-33%
shake128x4_absorb_once	✅	2s	2s	+0%
shake128x4_squeezeblocks	✅	2s	2s	+0%
shake256	✅	2s	2s	+0%
shake256_init	✅	2s	1s	+100%
shake256x4_absorb_once	✅	2s	3s	-33%
sys_check_capability	✅	2s	4s	-50%
unpack_sk_s2hat	✅	2s	1s	+100%
unpack_sk_t0hat	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	3s	-67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	2s	-50%
keccakf1600_extract_bytes (big endian)	✅	1s	2s	-50%
keccakf1600_xor_bytes (big endian)	✅	1s	2s	-50%
keccakf1600x4_extract_bytes_native	✅	1s	2s	-50%
mld_ct_sel_int32	✅	1s	3s	-67%
poly_pointwise_montgomery	✅	1s	4s	-75%
poly_uniform_4x	✅	1s	3s	-67%
poly_uniform_gamma1	✅	1s	3s	-67%
poly_use_hint	✅	1s	4s	-75%
polyw1_pack_32	✅	1s	4s	-75%
shake256_absorb	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-65)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
mld_attempt_signature_generation	⚠️	79s	50s	+58%

Full Results (206 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1881s	1869s	+0.6%
polyvecl_pointwise_acc_montgomery_c	✅	227s	246s	-8%
sign_verify_internal	✅	177s	180s	-2%
poly_pointwise_montgomery_c	✅	128s	131s	-2%
mld_invntt_layer	✅	115s	111s	+4%
polyvec_matrix_expand	✅	109s	111s	-2%
mld_attempt_signature_generation	⚠️	79s	50s	+58%
sign_signature_internal	✅	64s	54s	+19%
mld_ntt_layer	✅	44s	46s	-4%
fqmul	✅	39s	41s	-5%
polyvec_matrix_expand_serial	✅	28s	28s	+0%
keccakf1600x4_permute_native	✅	22s	24s	-8%
mld_ntt_butterfly_block	✅	22s	21s	+5%
polyvec_matrix_pointwise_montgomery_yvec	✅	21s	20s	+5%
poly_ntt_c	✅	18s	20s	-10%
rej_uniform_c	✅	17s	15s	+13%
compute_pack_t0_t1	✅	15s	12s	+25%
polyt0_unpack	✅	15s	16s	-6%
rej_uniform	✅	15s	16s	-6%
polyveck_decompose	✅	14s	12s	+17%
poly_chknorm_c	✅	13s	14s	-7%
poly_uniform_4x	✅	13s	14s	-7%
polyz_unpack_c	✅	13s	11s	+18%
poly_uniform_eta_4x	✅	12s	12s	+0%
mld_check_pct	✅	11s	15s	-27%
poly_invntt_tomont_c	✅	11s	12s	-8%
keccak_absorb_once_x4	✅	8s	9s	-11%
mld_compute_pack_z	✅	8s	7s	+14%
mld_keccakf1600_permute_c	✅	8s	8s	+0%
poly_add	✅	8s	8s	+0%
polyveck_invntt_tomont	✅	8s	10s	-20%
poly_decompose_c	✅	7s	5s	+40%
polyveck_ntt	✅	7s	7s	+0%
unpack_sk_t0hat	✅	7s	5s	+40%
mld_sample_s1_s2	✅	6s	6s	+0%
ntt_native_x86_64	✅	6s	3s	+100%
pointwise_acc_native_x86_64	✅	6s	8s	-25%
poly_use_hint_c	✅	6s	6s	+0%
polyveck_caddq	✅	6s	7s	-14%
polyveck_pack_w1	✅	6s	2s	+200%
polyvecl_ntt	✅	6s	3s	+100%
polyvecl_pointwise_acc_montgomery_native	✅	6s	4s	+50%
keccak_init	✅	5s	3s	+67%
keccak_squeezeblocks_x4	✅	5s	6s	-17%
keccakf1600x4_xor_bytes_native	✅	5s	3s	+67%
make_hint	✅	5s	4s	+25%
mld_ct_memcmp	✅	5s	2s	+150%
mld_h	✅	5s	4s	+25%
ntt_native_aarch64	✅	5s	4s	+25%
pointwise_acc_native_aarch64	✅	5s	7s	-29%
pointwise_native_aarch64	✅	5s	1s	+400%
poly_caddq_c	✅	5s	2s	+150%
poly_decompose_native	✅	5s	3s	+67%
poly_invntt_tomont_native	✅	5s	3s	+67%
poly_reduce	✅	5s	2s	+150%
polyeta_pack	✅	5s	2s	+150%
polyeta_unpack	✅	5s	7s	-29%
polyt0_pack	✅	5s	4s	+25%
polyt1_unpack	✅	5s	4s	+25%
polyveck_chknorm	✅	5s	6s	-17%
polyveck_unpack_eta	✅	5s	3s	+67%
polyw1_pack_32	✅	5s	2s	+150%
rej_eta_native	✅	5s	4s	+25%
rej_uniform_native	✅	5s	6s	-17%
sign_keypair	✅	5s	4s	+25%
sign_signature_extmu	✅	5s	6s	-17%
sign_signature_pre_hash_shake256	✅	5s	6s	-17%
sign_verify_extmu	✅	5s	4s	+25%
keccak_f1600_x4_native_aarch64_v84a	✅	4s	4s	+0%
mld_prepare_domain_separation_prefix	✅	4s	3s	+33%
mld_sign_attempt	✅	4s	-	new
montgomery_reduce	✅	4s	2s	+100%
nttunpack_native_x86_64	✅	4s	3s	+33%
pack_sig_c	✅	4s	3s	+33%
pack_sig_h	✅	4s	2s	+100%
pack_sig_z	✅	4s	2s	+100%
pack_sk_rho_key_tr_s2	✅	4s	3s	+33%
poly_caddq	✅	4s	3s	+33%
poly_challenge	✅	4s	5s	-20%
poly_chknorm_native	✅	4s	4s	+0%
poly_chknorm_native_aarch64	✅	4s	6s	-33%
poly_decompose_32_native_aarch64	✅	4s	5s	-20%
poly_ntt_native	✅	4s	3s	+33%
poly_shiftl	✅	4s	4s	+0%
poly_uniform	✅	4s	4s	+0%
poly_use_hint_native	✅	4s	1s	+300%
polyvecl_chknorm	✅	4s	7s	-43%
polyvecl_unpack_eta	✅	4s	1s	+300%
polyz_pack	✅	4s	3s	+33%
polyz_unpack_19_native_aarch64	✅	4s	4s	+0%
reduce32	✅	4s	5s	-20%
rej_uniform_eta_native_aarch64	✅	4s	3s	+33%
rej_uniform_native_aarch64	✅	4s	3s	+33%
shake128_init	✅	4s	4s	+0%
shake256_init	✅	4s	2s	+100%
sig_unpack_hints	✅	4s	5s	-20%
sign_pk_from_sk	✅	4s	5s	-20%
sign_signature	✅	4s	4s	+0%
sign_verify_pre_hash_internal	✅	4s	4s	+0%
sign_verify_pre_hash_shake256	✅	4s	3s	+33%
unpack_sk	✅	4s	6s	-33%
decompose	✅	3s	2s	+50%
intt_native_aarch64	✅	3s	2s	+50%
intt_native_x86_64	✅	3s	5s	-40%
keccak_absorb	✅	3s	4s	-25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	3s	+0%
keccak_finalize	✅	3s	2s	+50%
keccak_squeeze	✅	3s	2s	+50%
keccakf1600_extract_bytes (big endian)	✅	3s	3s	+0%
keccakf1600_permute_native	✅	3s	1s	+200%
keccakf1600_xor_bytes	✅	3s	4s	-25%
keccakf1600x4_extract_bytes	✅	3s	2s	+50%
keccakf1600x4_extract_bytes_native	✅	3s	1s	+200%
keccakf1600x4_permute	✅	3s	5s	-40%
keccakf1600x4_xor_bytes	✅	3s	3s	+0%
mld_ct_abs_i32	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u32	✅	3s	2s	+50%
mld_ct_get_optblocker_i64	✅	3s	1s	+200%
mld_ct_sel_int32	✅	3s	2s	+50%
mld_keccakf1600x4_extract_bytes_c	✅	3s	2s	+50%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_polymat_expand_entry	✅	3s	4s	-25%
mld_sample_s1_s2_serial	✅	3s	6s	-50%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_u8	✅	3s	1s	+200%
pack_sk_s1	✅	3s	2s	+50%
poly_caddq_native	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	4s	-25%
poly_caddq_native_x86_64	✅	3s	5s	-40%
poly_chknorm	✅	3s	2s	+50%
poly_chknorm_native_x86_64	✅	3s	5s	-40%
poly_decompose	✅	3s	3s	+0%
poly_invntt_tomont	✅	3s	3s	+0%
poly_ntt	✅	3s	3s	+0%
poly_pointwise_montgomery	✅	3s	4s	-25%
poly_pointwise_montgomery_native	✅	3s	4s	-25%
poly_power2round	✅	3s	4s	-25%
poly_sub	✅	3s	4s	-25%
poly_uniform_eta	✅	3s	3s	+0%
poly_uniform_gamma1	✅	3s	3s	+0%
poly_use_hint	✅	3s	2s	+50%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyt1_pack	✅	3s	4s	-25%
polyveck_pack_eta	✅	3s	4s	-25%
polyveck_reduce	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery	✅	3s	4s	-25%
polyvecl_uniform_gamma1	✅	3s	4s	-25%
polyw1_pack_88	✅	3s	4s	-25%
polyz_unpack_17_native_aarch64	✅	3s	3s	+0%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
power2round	✅	3s	3s	+0%
rej_eta_c	✅	3s	2s	+50%
shake128_finalize	✅	3s	3s	+0%
shake128_squeeze	✅	3s	2s	+50%
shake128x4_squeezeblocks	✅	3s	3s	+0%
shake256_squeeze	✅	3s	1s	+200%
sign_keypair_internal	✅	3s	5s	-40%
sign_signature_pre_hash_internal	✅	3s	3s	+0%
sk_s1hat_get_poly	✅	3s	3s	+0%
sys_check_capability	✅	3s	3s	+0%
unpack_pk_t1	✅	3s	5s	-40%
unpack_sk_s1hat	✅	3s	5s	-40%
unpack_sk_s2hat	✅	3s	3s	+0%
use_hint	✅	3s	5s	-40%
yvec_get_poly	✅	3s	5s	-40%
caddq	✅	2s	3s	-33%
fqscale	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccakf1600_permute	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_ct_get_optblocker_u32	✅	2s	5s	-60%
mld_sign_resume	✅	2s	-	new
mld_value_barrier_u32	✅	2s	3s	-33%
pointwise_native_x86_64	✅	2s	3s	-33%
poly_decompose_88_native_aarch64	✅	2s	4s	-50%
poly_permute_bitrev_to_custom_optional	✅	2s	4s	-50%
poly_uniform_gamma1_4x	✅	2s	5s	-60%
polyvec_matrix_pointwise_montgomery_row	✅	2s	3s	-33%
polyvecl_pack_eta	✅	2s	4s	-50%
polyvecl_uniform_gamma1_serial	✅	2s	3s	-33%
polyvecl_unpack_z	✅	2s	5s	-60%
polyw1_pack	✅	2s	4s	-50%
polyz_unpack	✅	2s	2s	+0%
polyz_unpack_native	✅	2s	2s	+0%
rej_eta	✅	2s	2s	+0%
shake128_absorb	✅	2s	3s	-33%
shake128_release	✅	2s	1s	+100%
shake256_absorb	✅	2s	4s	-50%
shake256_finalize	✅	2s	2s	+0%
shake256x4_absorb_once	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	3s	-33%
sign_verify	✅	2s	8s	-75%
sk_t0hat_get_poly	✅	2s	3s	-33%
yvec_init	✅	2s	2s	+0%
keccakf1600_xor_bytes (big endian)	✅	1s	2s	-50%
mld_ct_get_optblocker_u8	✅	1s	3s	-67%
mld_keccakf1600_extract_bytes	✅	1s	3s	-67%
mld_value_barrier_i64	✅	1s	2s	-50%
poly_permute_bitrev_to_custom_optional_native	✅	1s	3s	-67%
shake128x4_absorb_once	✅	1s	3s	-67%
shake256	✅	1s	2s	-50%
shake256_release	✅	1s	2s	-50%
sk_s2hat_get_poly	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-44)

Full Results (206 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1580s	1686s	-6.3%
polyvecl_pointwise_acc_montgomery_c	✅	142s	175s	-19%
poly_pointwise_montgomery_c	✅	133s	147s	-10%
sign_verify_internal	✅	121s	130s	-7%
mld_invntt_layer	✅	112s	123s	-9%
compute_pack_t0_t1	✅	51s	55s	-7%
mld_attempt_signature_generation	✅	44s	54s	-19%
mld_ntt_layer	✅	44s	47s	-6%
fqmul	✅	41s	46s	-11%
polyvec_matrix_expand	✅	29s	30s	-3%
keccakf1600x4_permute_native	✅	22s	21s	+5%
mld_ntt_butterfly_block	✅	22s	25s	-12%
sign_signature_internal	✅	22s	20s	+10%
poly_ntt_c	✅	18s	21s	-14%
polyvec_matrix_pointwise_montgomery_yvec	✅	18s	18s	+0%
polyeta_unpack	✅	16s	18s	-11%
polyt0_unpack	✅	16s	15s	+7%
rej_uniform_c	✅	16s	18s	-11%
rej_uniform	✅	15s	18s	-17%
mld_check_pct	✅	14s	15s	-7%
poly_chknorm_c	✅	14s	17s	-18%
poly_uniform_4x	✅	13s	13s	+0%
mld_keccakf1600_permute_c	✅	10s	7s	+43%
poly_invntt_tomont_c	✅	10s	12s	-17%
polyz_unpack_c	✅	10s	11s	-9%
keccak_absorb_once_x4	✅	9s	9s	+0%
poly_uniform_eta_4x	✅	9s	13s	-31%
polyvecl_chknorm	✅	9s	12s	-25%
polyvec_matrix_expand_serial	✅	7s	8s	-12%
sign_signature	✅	7s	2s	+250%
sign_signature_extmu	✅	7s	6s	+17%
sign_signature_pre_hash_shake256	✅	7s	6s	+17%
caddq	✅	6s	2s	+200%
keccak_absorb	✅	6s	3s	+100%
keccakf1600_xor_bytes	✅	6s	1s	+500%
mld_compute_pack_z	✅	6s	7s	-14%
pointwise_acc_native_aarch64	✅	6s	8s	-25%
poly_add	✅	6s	9s	-33%
poly_uniform	✅	6s	4s	+50%
polyveck_invntt_tomont	✅	6s	4s	+50%
polyw1_pack_32	✅	6s	4s	+50%
intt_native_x86_64	✅	5s	3s	+67%
make_hint	✅	5s	3s	+67%
mld_prepare_domain_separation_prefix	✅	5s	4s	+25%
pointwise_acc_native_x86_64	✅	5s	6s	-17%
poly_caddq_native_x86_64	✅	5s	2s	+150%
poly_challenge	✅	5s	4s	+25%
poly_chknorm	✅	5s	5s	+0%
poly_decompose_32_native_aarch64	✅	5s	5s	+0%
poly_decompose_c	✅	5s	6s	-17%
poly_invntt_tomont	✅	5s	5s	+0%
polyt0_pack	✅	5s	5s	+0%
polyt1_unpack	✅	5s	4s	+25%
polyveck_caddq	✅	5s	7s	-29%
polyveck_decompose	✅	5s	6s	-17%
polyveck_reduce	✅	5s	3s	+67%
polyvecl_unpack_eta	✅	5s	2s	+150%
rej_eta_native	✅	5s	5s	+0%
rej_uniform_native	✅	5s	6s	-17%
shake128x4_squeezeblocks	✅	5s	2s	+150%
shake256	✅	5s	3s	+67%
shake256_finalize	✅	5s	2s	+150%
sign_signature_pre_hash_internal	✅	5s	5s	+0%
sign_verify	✅	5s	3s	+67%
sign_verify_pre_hash_shake256	✅	5s	4s	+25%
sys_check_capability	✅	5s	3s	+67%
keccak_init	✅	4s	2s	+100%
keccak_squeezeblocks_x4	✅	4s	5s	-20%
keccakf1600_permute_native	✅	4s	3s	+33%
mld_ct_cmask_nonzero_u32	✅	4s	3s	+33%
mld_ct_cmask_nonzero_u8	✅	4s	4s	+0%
mld_polymat_expand_entry	✅	4s	3s	+33%
mld_sample_s1_s2	✅	4s	5s	-20%
mld_sample_s1_s2_serial	✅	4s	4s	+0%
montgomery_reduce	✅	4s	2s	+100%
ntt_native_aarch64	✅	4s	4s	+0%
pointwise_native_aarch64	✅	4s	5s	-20%
poly_chknorm_native	✅	4s	2s	+100%
poly_decompose_88_native_aarch64	✅	4s	3s	+33%
poly_pointwise_montgomery	✅	4s	4s	+0%
poly_pointwise_montgomery_native	✅	4s	3s	+33%
poly_power2round	✅	4s	4s	+0%
poly_uniform_gamma1	✅	4s	2s	+100%
polyeta_pack	✅	4s	3s	+33%
polyt1_pack	✅	4s	2s	+100%
polyvec_matrix_pointwise_montgomery_row	✅	4s	3s	+33%
polyveck_chknorm	✅	4s	3s	+33%
rej_eta	✅	4s	3s	+33%
shake128x4_absorb_once	✅	4s	2s	+100%
shake256_release	✅	4s	1s	+300%
shake256x4_squeezeblocks	✅	4s	2s	+100%
sig_unpack_hints	✅	4s	3s	+33%
sign_keypair	✅	4s	6s	-33%
sign_keypair_internal	✅	4s	7s	-43%
sign_pk_from_sk	✅	4s	3s	+33%
unpack_pk_t1	✅	4s	3s	+33%
unpack_sk_t0hat	✅	4s	4s	+0%
yvec_get_poly	✅	4s	3s	+33%
decompose	✅	3s	3s	+0%
fqscale	✅	3s	3s	+0%
intt_native_aarch64	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	1s	+200%
keccak_finalize	✅	3s	3s	+0%
keccakf1600_xor_bytes (big endian)	✅	3s	4s	-25%
mld_ct_abs_i32	✅	3s	4s	-25%
mld_ct_get_optblocker_u32	✅	3s	3s	+0%
mld_ct_get_optblocker_u8	✅	3s	1s	+200%
mld_sign_attempt	✅	3s	-	new
mld_sign_finish	✅	3s	-	new
mld_sign_resume	✅	3s	-	new
mld_value_barrier_u32	✅	3s	2s	+50%
mld_value_barrier_u8	✅	3s	3s	+0%
pack_sig_c	✅	3s	4s	-25%
pack_sig_h	✅	3s	1s	+200%
pack_sk_rho_key_tr_s2	✅	3s	2s	+50%
pack_sk_s1	✅	3s	3s	+0%
pointwise_native_x86_64	✅	3s	5s	-40%
poly_caddq	✅	3s	1s	+200%
poly_caddq_c	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	5s	-40%
poly_chknorm_native_aarch64	✅	3s	3s	+0%
poly_chknorm_native_x86_64	✅	3s	4s	-25%
poly_decompose	✅	3s	2s	+50%
poly_invntt_tomont_native	✅	3s	2s	+50%
poly_ntt_native	✅	3s	4s	-25%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_reduce	✅	3s	5s	-40%
poly_shiftl	✅	3s	5s	-40%
poly_sub	✅	3s	4s	-25%
poly_uniform_eta	✅	3s	4s	-25%
poly_uniform_gamma1_4x	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	4s	-25%
polyveck_ntt	✅	3s	6s	-50%
polyveck_pack_eta	✅	3s	2s	+50%
polyveck_pack_w1	✅	3s	2s	+50%
polyvecl_ntt	✅	3s	5s	-40%
polyvecl_pointwise_acc_montgomery	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery_native	✅	3s	4s	-25%
polyvecl_uniform_gamma1	✅	3s	2s	+50%
polyvecl_unpack_z	✅	3s	3s	+0%
polyw1_pack_88	✅	3s	2s	+50%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	2s	+50%
reduce32	✅	3s	3s	+0%
shake128_init	✅	3s	4s	-25%
shake256_init	✅	3s	2s	+50%
sign_verify_extmu	✅	3s	3s	+0%
sign_verify_pre_hash_internal	✅	3s	5s	-40%
sk_s1hat_get_poly	✅	3s	2s	+50%
sk_t0hat_get_poly	✅	3s	5s	-40%
unpack_sk	✅	3s	4s	-25%
unpack_sk_s1hat	✅	3s	3s	+0%
use_hint	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	2s	+0%
keccak_f1600_x4_native_avx2	✅	2s	3s	-33%
keccak_squeeze	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	3s	-33%
keccakf1600x4_permute	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	2s	+0%
mld_ct_memcmp	✅	2s	2s	+0%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_h	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	4s	-50%
mld_keccakf1600x4_xor_bytes_c	✅	2s	4s	-50%
mld_value_barrier_i64	✅	2s	4s	-50%
ntt_native_x86_64	✅	2s	3s	-33%
nttunpack_native_x86_64	✅	2s	4s	-50%
pack_sig_z	✅	2s	6s	-67%
poly_caddq_native	✅	2s	5s	-60%
poly_decompose_native	✅	2s	2s	+0%
poly_ntt	✅	2s	4s	-50%
poly_permute_bitrev_to_custom_optional	✅	2s	3s	-33%
poly_use_hint	✅	2s	3s	-33%
poly_use_hint_c	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	2s	+0%
polyveck_unpack_eta	✅	2s	3s	-33%
polyvecl_pack_eta	✅	2s	2s	+0%
polyvecl_uniform_gamma1_serial	✅	2s	3s	-33%
polyw1_pack	✅	2s	1s	+100%
polyz_pack	✅	2s	4s	-50%
polyz_unpack_17_native_aarch64	✅	2s	2s	+0%
polyz_unpack_19_native_aarch64	✅	2s	4s	-50%
polyz_unpack_native_x86_64	✅	2s	2s	+0%
power2round	✅	2s	4s	-50%
rej_eta_c	✅	2s	6s	-67%
rej_uniform_eta_native_aarch64	✅	2s	3s	-33%
rej_uniform_native_aarch64	✅	2s	4s	-50%
shake128_finalize	✅	2s	2s	+0%
shake128_release	✅	2s	3s	-33%
shake128_squeeze	✅	2s	2s	+0%
shake256_squeeze	✅	2s	4s	-50%
shake256x4_absorb_once	✅	2s	1s	+100%
sk_s2hat_get_poly	✅	2s	3s	-33%
unpack_sk_s2hat	✅	2s	4s	-50%
yvec_init	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	2s	-50%
keccakf1600_extract_bytes (big endian)	✅	1s	2s	-50%
keccakf1600_permute	✅	1s	3s	-67%
keccakf1600x4_xor_bytes	✅	1s	3s	-67%
keccakf1600x4_xor_bytes_native	✅	1s	4s	-75%
mld_ct_cmask_neg_i32	✅	1s	2s	-50%
mld_keccakf1600_extract_bytes	✅	1s	2s	-50%
shake128_absorb	✅	1s	4s	-75%
shake256_absorb	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
sign_signature_internal	⚠️	64s	28s	+129%

Full Results (206 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2076s	2219s	-6.4%
polyvecl_pointwise_acc_montgomery_c	✅	333s	376s	-11%
polyvec_matrix_expand	✅	294s	326s	-10%
poly_pointwise_montgomery_c	✅	126s	140s	-10%
mld_invntt_layer	✅	115s	116s	-1%
sign_verify_internal	✅	96s	101s	-5%
sign_signature_internal	⚠️	64s	28s	+129%
mld_attempt_signature_generation	✅	53s	122s	-57%
mld_ntt_layer	✅	43s	43s	+0%
fqmul	✅	41s	42s	-2%
polyvec_matrix_expand_serial	✅	36s	37s	-3%
mld_ntt_butterfly_block	✅	23s	24s	-4%
keccakf1600x4_permute_native	✅	21s	23s	-9%
poly_ntt_c	✅	19s	20s	-5%
polyvec_matrix_pointwise_montgomery_yvec	✅	19s	17s	+12%
compute_pack_t0_t1	✅	17s	17s	+0%
mld_check_pct	✅	16s	15s	+7%
poly_chknorm_c	✅	15s	16s	-6%
polyeta_unpack	✅	15s	17s	-12%
polyt0_unpack	✅	15s	18s	-17%
rej_uniform	✅	14s	18s	-22%
rej_uniform_c	✅	14s	14s	+0%
poly_uniform_4x	✅	13s	12s	+8%
poly_uniform_eta_4x	✅	12s	13s	-8%
keccak_absorb_once_x4	✅	11s	10s	+10%
mld_compute_pack_z	✅	10s	10s	+0%
poly_invntt_tomont_c	✅	10s	14s	-29%
polyveck_decompose	✅	10s	11s	-9%
pointwise_acc_native_x86_64	✅	9s	8s	+12%
poly_add	✅	8s	10s	-20%
polyveck_caddq	✅	8s	7s	+14%
polyvecl_ntt	✅	8s	7s	+14%
mld_keccakf1600_permute_c	✅	7s	5s	+40%
poly_uniform_gamma1_4x	✅	7s	4s	+75%
poly_use_hint_c	✅	7s	3s	+133%
polyveck_invntt_tomont	✅	7s	5s	+40%
polyveck_ntt	✅	7s	9s	-22%
rej_eta_c	✅	7s	4s	+75%
unpack_sk_t0hat	✅	7s	7s	+0%
mld_sample_s1_s2_serial	✅	6s	5s	+20%
pack_sig_z	✅	6s	2s	+200%
pointwise_acc_native_aarch64	✅	6s	7s	-14%
poly_power2round	✅	6s	2s	+200%
polyt1_unpack	✅	6s	5s	+20%
polyz_unpack_native	✅	6s	3s	+100%
rej_uniform_native	✅	6s	5s	+20%
sign_keypair	✅	6s	5s	+20%
sign_keypair_internal	✅	6s	5s	+20%
intt_native_aarch64	✅	5s	3s	+67%
mld_ct_abs_i32	✅	5s	2s	+150%
mld_prepare_domain_separation_prefix	✅	5s	3s	+67%
mld_sample_s1_s2	✅	5s	8s	-38%
montgomery_reduce	✅	5s	5s	+0%
pointwise_native_aarch64	✅	5s	3s	+67%
poly_challenge	✅	5s	3s	+67%
poly_decompose_c	✅	5s	4s	+25%
poly_uniform	✅	5s	5s	+0%
polyt0_pack	✅	5s	5s	+0%
polyt1_pack	✅	5s	2s	+150%
polyveck_chknorm	✅	5s	5s	+0%
polyvecl_chknorm	✅	5s	4s	+25%
polyz_unpack_17_native_aarch64	✅	5s	2s	+150%
rej_eta	✅	5s	5s	+0%
rej_eta_native	✅	5s	6s	-17%
sign_pk_from_sk	✅	5s	9s	-44%
sign_signature_pre_hash_internal	✅	5s	6s	-17%
sign_signature_pre_hash_shake256	✅	5s	6s	-17%
sign_verify_pre_hash_internal	✅	5s	3s	+67%
sys_check_capability	✅	5s	4s	+25%
keccak_absorb	✅	4s	4s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	4s	+0%
keccakf1600_permute	✅	4s	3s	+33%
keccakf1600_xor_bytes	✅	4s	4s	+0%
mld_ct_cmask_neg_i32	✅	4s	3s	+33%
mld_ct_cmask_nonzero_u8	✅	4s	1s	+300%
mld_keccakf1600_extract_bytes	✅	4s	2s	+100%
mld_sign_attempt	✅	4s	-	new
mld_sign_finish	✅	4s	-	new
mld_sign_resume	✅	4s	-	new
ntt_native_x86_64	✅	4s	4s	+0%
pack_sig_c	✅	4s	5s	-20%
pack_sig_h	✅	4s	3s	+33%
pack_sk_s1	✅	4s	2s	+100%
poly_caddq_c	✅	4s	3s	+33%
poly_caddq_native_x86_64	✅	4s	4s	+0%
poly_chknorm_native	✅	4s	4s	+0%
poly_decompose_native	✅	4s	3s	+33%
poly_invntt_tomont_native	✅	4s	3s	+33%
poly_ntt_native	✅	4s	4s	+0%
poly_pointwise_montgomery_native	✅	4s	2s	+100%
poly_shiftl	✅	4s	4s	+0%
poly_uniform_gamma1	✅	4s	3s	+33%
polyveck_pack_w1	✅	4s	2s	+100%
polyveck_reduce	✅	4s	3s	+33%
polyvecl_pack_eta	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery_native	✅	4s	4s	+0%
polyvecl_uniform_gamma1	✅	4s	3s	+33%
polyvecl_uniform_gamma1_serial	✅	4s	2s	+100%
polyz_unpack_19_native_aarch64	✅	4s	3s	+33%
power2round	✅	4s	3s	+33%
shake256_absorb	✅	4s	2s	+100%
shake256x4_absorb_once	✅	4s	2s	+100%
sk_s1hat_get_poly	✅	4s	4s	+0%
sk_s2hat_get_poly	✅	4s	2s	+100%
sk_t0hat_get_poly	✅	4s	2s	+100%
unpack_sk_s1hat	✅	4s	4s	+0%
use_hint	✅	4s	2s	+100%
fqscale	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	2s	+50%
keccakf1600_extract_bytes (big endian)	✅	3s	2s	+50%
keccakf1600_permute_native	✅	3s	2s	+50%
keccakf1600x4_permute	✅	3s	2s	+50%
keccakf1600x4_xor_bytes	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u32	✅	3s	4s	-25%
mld_ct_get_optblocker_u8	✅	3s	3s	+0%
mld_ct_memcmp	✅	3s	2s	+50%
mld_keccakf1600x4_extract_bytes_c	✅	3s	4s	-25%
mld_value_barrier_u32	✅	3s	4s	-25%
mld_value_barrier_u8	✅	3s	3s	+0%
nttunpack_native_x86_64	✅	3s	5s	-40%
pointwise_native_x86_64	✅	3s	4s	-25%
poly_caddq_native_aarch64	✅	3s	5s	-40%
poly_chknorm_native_x86_64	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	3s	2s	+50%
poly_reduce	✅	3s	4s	-25%
poly_sub	✅	3s	2s	+50%
poly_uniform_eta	✅	3s	5s	-40%
poly_use_hint_native_aarch64	✅	3s	6s	-50%
polyveck_pack_eta	✅	3s	5s	-40%
polyveck_unpack_eta	✅	3s	3s	+0%
polyvecl_unpack_eta	✅	3s	4s	-25%
polyvecl_unpack_z	✅	3s	7s	-57%
polyw1_pack_32	✅	3s	4s	-25%
polyz_pack	✅	3s	2s	+50%
polyz_unpack	✅	3s	4s	-25%
polyz_unpack_c	✅	3s	2s	+50%
rej_uniform_eta_native_aarch64	✅	3s	3s	+0%
shake128_finalize	✅	3s	1s	+200%
shake128_init	✅	3s	1s	+200%
shake128_release	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	1s	+200%
shake256	✅	3s	3s	+0%
shake256x4_squeezeblocks	✅	3s	4s	-25%
sig_unpack_hints	✅	3s	3s	+0%
sign_signature	✅	3s	2s	+50%
sign_signature_extmu	✅	3s	3s	+0%
sign_verify_extmu	✅	3s	5s	-40%
sign_verify_pre_hash_shake256	✅	3s	6s	-50%
decompose	✅	2s	4s	-50%
intt_native_x86_64	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	5s	-60%
keccak_finalize	✅	2s	2s	+0%
keccak_init	✅	2s	4s	-50%
keccak_squeeze	✅	2s	3s	-33%
keccak_squeezeblocks_x4	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	1s	+100%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	4s	-50%
make_hint	✅	2s	4s	-50%
mld_ct_get_optblocker_i64	✅	2s	4s	-50%
mld_h	✅	2s	5s	-60%
mld_keccakf1600x4_xor_bytes_c	✅	2s	3s	-33%
mld_polymat_expand_entry	✅	2s	2s	+0%
mld_value_barrier_i64	✅	2s	3s	-33%
ntt_native_aarch64	✅	2s	2s	+0%
pack_sk_rho_key_tr_s2	✅	2s	2s	+0%
poly_caddq_native	✅	2s	2s	+0%
poly_chknorm	✅	2s	2s	+0%
poly_decompose	✅	2s	2s	+0%
poly_decompose_32_native_aarch64	✅	2s	4s	-50%
poly_decompose_88_native_aarch64	✅	2s	3s	-33%
poly_pointwise_montgomery	✅	2s	2s	+0%
poly_use_hint	✅	2s	4s	-50%
poly_use_hint_native	✅	2s	2s	+0%
polyeta_pack	✅	2s	4s	-50%
polyvec_matrix_pointwise_montgomery_row	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	4s	-50%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
reduce32	✅	2s	3s	-33%
rej_uniform_native_aarch64	✅	2s	2s	+0%
shake128_absorb	✅	2s	5s	-60%
shake128_squeeze	✅	2s	1s	+100%
shake256_finalize	✅	2s	2s	+0%
shake256_init	✅	2s	1s	+100%
sign_verify	✅	2s	4s	-50%
unpack_pk_t1	✅	2s	3s	-33%
unpack_sk	✅	2s	3s	-33%
unpack_sk_s2hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	4s	-50%
caddq	✅	1s	3s	-67%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	2s	-50%
keccak_f1600_x4_native_avx2	✅	1s	3s	-67%
keccakf1600x4_xor_bytes_native	✅	1s	2s	-50%
mld_ct_get_optblocker_u32	✅	1s	3s	-67%
mld_ct_sel_int32	✅	1s	2s	-50%
poly_caddq	✅	1s	4s	-75%
poly_chknorm_native_aarch64	✅	1s	3s	-67%
poly_invntt_tomont	✅	1s	1s	+0%
poly_ntt	✅	1s	4s	-75%
poly_permute_bitrev_to_custom_optional	✅	1s	2s	-50%
polyw1_pack	✅	1s	3s	-67%
shake128x4_absorb_once	✅	1s	4s	-75%
shake256_release	✅	1s	2s	-50%
shake256_squeeze	✅	1s	3s	-67%
yvec_init	✅	1s	5s	-80%

[oqs-bot]

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (206 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1447s	1441s	+0.4%
polyvec_matrix_pointwise_montgomery_yvec	✅	193s	187s	+3%
poly_pointwise_montgomery_c	✅	113s	116s	-3%
mld_invntt_layer	✅	101s	99s	+2%
sign_verify_internal	✅	66s	72s	-8%
mld_ntt_layer	✅	43s	41s	+5%
polyvecl_chknorm	✅	42s	41s	+2%
fqmul	✅	41s	41s	+0%
polyveck_chknorm	✅	32s	32s	+0%
mld_attempt_signature_generation	✅	29s	27s	+7%
keccakf1600x4_permute_native	✅	22s	23s	-4%
mld_ntt_butterfly_block	✅	22s	19s	+16%
poly_ntt_c	✅	20s	21s	-5%
mld_check_pct	✅	15s	11s	+36%
rej_uniform_c	✅	15s	15s	+0%
poly_chknorm_c	✅	12s	11s	+9%
polyveck_decompose	✅	12s	12s	+0%
poly_invntt_tomont_c	✅	11s	12s	-8%
polyt0_unpack	✅	11s	14s	-21%
poly_uniform_eta_4x	✅	10s	14s	-29%
keccak_absorb_once_x4	✅	9s	8s	+12%
polyvec_matrix_pointwise_montgomery_row	✅	9s	9s	+0%
compute_pack_t0_t1	✅	8s	6s	+33%
polyveck_caddq	✅	8s	5s	+60%
pointwise_acc_native_aarch64	✅	7s	5s	+40%
pointwise_acc_native_x86_64	✅	7s	8s	-12%
poly_decompose_c	✅	7s	6s	+17%
polyveck_invntt_tomont	✅	7s	4s	+75%
polyvecl_ntt	✅	7s	6s	+17%
polyz_unpack_c	✅	7s	8s	-12%
rej_uniform	✅	7s	9s	-22%
sign_pk_from_sk	✅	7s	6s	+17%
keccak_absorb	✅	6s	3s	+100%
mld_compute_pack_z	✅	6s	6s	+0%
mld_keccakf1600_permute_c	✅	6s	5s	+20%
mld_sample_s1_s2_serial	✅	6s	3s	+100%
mld_sign_attempt	✅	6s	-	new
poly_add	✅	6s	6s	+0%
poly_power2round	✅	6s	4s	+50%
poly_uniform	✅	6s	3s	+100%
sign_signature_internal	✅	6s	5s	+20%
keccak_f1600_x4_native_avx2	✅	5s	3s	+67%
keccakf1600x4_xor_bytes_native	✅	5s	2s	+150%
mld_sample_s1_s2	✅	5s	6s	-17%
mld_sign_finish	✅	5s	-	new
poly_chknorm	✅	5s	5s	+0%
poly_permute_bitrev_to_custom_optional	✅	5s	2s	+150%
poly_pointwise_montgomery	✅	5s	4s	+25%
poly_pointwise_montgomery_native	✅	5s	4s	+25%
polyveck_reduce	✅	5s	8s	-38%
polyz_unpack_19_native_aarch64	✅	5s	5s	+0%
rej_uniform_native_aarch64	✅	5s	2s	+150%
shake128_absorb	✅	5s	3s	+67%
shake128_finalize	✅	5s	2s	+150%
shake128_release	✅	5s	3s	+67%
shake128_squeeze	✅	5s	4s	+25%
sign_keypair_internal	✅	5s	4s	+25%
sign_verify	✅	5s	8s	-38%
sign_verify_pre_hash_internal	✅	5s	4s	+25%
intt_native_x86_64	✅	4s	4s	+0%
mld_ct_cmask_nonzero_u8	✅	4s	4s	+0%
mld_h	✅	4s	2s	+100%
mld_keccakf1600x4_extract_bytes_c	✅	4s	3s	+33%
mld_polymat_expand_entry	✅	4s	5s	-20%
poly_caddq_c	✅	4s	4s	+0%
poly_caddq_native_aarch64	✅	4s	2s	+100%
poly_chknorm_native_x86_64	✅	4s	3s	+33%
poly_decompose	✅	4s	4s	+0%
poly_decompose_32_native_aarch64	✅	4s	3s	+33%
poly_decompose_88_native_aarch64	✅	4s	2s	+100%
poly_invntt_tomont_native	✅	4s	2s	+100%
poly_ntt_native	✅	4s	2s	+100%
poly_reduce	✅	4s	5s	-20%
poly_sub	✅	4s	3s	+33%
poly_uniform_eta	✅	4s	5s	-20%
poly_use_hint	✅	4s	2s	+100%
polyt1_pack	✅	4s	2s	+100%
polyt1_unpack	✅	4s	4s	+0%
polyveck_unpack_eta	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	4s	5s	-20%
polyw1_pack_32	✅	4s	3s	+33%
polyz_pack	✅	4s	3s	+33%
polyz_unpack_native_x86_64	✅	4s	2s	+100%
rej_uniform_eta_native_aarch64	✅	4s	4s	+0%
rej_uniform_native	✅	4s	3s	+33%
sign_keypair	✅	4s	5s	-20%
sign_signature_pre_hash_shake256	✅	4s	6s	-33%
sign_verify_pre_hash_shake256	✅	4s	5s	-20%
sys_check_capability	✅	4s	5s	-20%
use_hint	✅	4s	4s	+0%
decompose	✅	3s	4s	-25%
intt_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x1_native_aarch64	✅	3s	1s	+200%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	1s	+200%
keccak_squeeze	✅	3s	4s	-25%
keccakf1600_extract_bytes (big endian)	✅	3s	1s	+200%
keccakf1600_permute	✅	3s	3s	+0%
keccakf1600_permute_native	✅	3s	5s	-40%
keccakf1600x4_extract_bytes	✅	3s	2s	+50%
keccakf1600x4_permute	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u32	✅	3s	4s	-25%
mld_ct_get_optblocker_u32	✅	3s	3s	+0%
mld_ct_sel_int32	✅	3s	3s	+0%
mld_keccakf1600_extract_bytes	✅	3s	1s	+200%
mld_sign_resume	✅	3s	-	new
mld_value_barrier_u32	✅	3s	1s	+200%
mld_value_barrier_u8	✅	3s	1s	+200%
ntt_native_aarch64	✅	3s	6s	-50%
pack_sig_z	✅	3s	2s	+50%
pack_sk_rho_key_tr_s2	✅	3s	3s	+0%
pointwise_native_aarch64	✅	3s	4s	-25%
pointwise_native_x86_64	✅	3s	2s	+50%
poly_caddq	✅	3s	2s	+50%
poly_caddq_native	✅	3s	3s	+0%
poly_caddq_native_x86_64	✅	3s	2s	+50%
poly_challenge	✅	3s	3s	+0%
poly_chknorm_native	✅	3s	3s	+0%
poly_decompose_native	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional_native	✅	3s	5s	-40%
poly_uniform_4x	✅	3s	2s	+50%
poly_uniform_gamma1	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	2s	+50%
polyeta_unpack	✅	3s	3s	+0%
polyt0_pack	✅	3s	3s	+0%
polyvec_matrix_expand_serial	✅	3s	2s	+50%
polyveck_ntt	✅	3s	1s	+200%
polyvecl_pack_eta	✅	3s	2s	+50%
polyvecl_uniform_gamma1	✅	3s	3s	+0%
polyw1_pack_88	✅	3s	2s	+50%
polyz_unpack	✅	3s	4s	-25%
polyz_unpack_17_native_aarch64	✅	3s	2s	+50%
power2round	✅	3s	3s	+0%
rej_eta	✅	3s	3s	+0%
rej_eta_c	✅	3s	4s	-25%
rej_eta_native	✅	3s	4s	-25%
shake128_init	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256	✅	3s	3s	+0%
shake256_absorb	✅	3s	2s	+50%
shake256_finalize	✅	3s	2s	+50%
shake256_release	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	2s	+50%
sign_signature_pre_hash_internal	✅	3s	5s	-40%
sign_verify_extmu	✅	3s	5s	-40%
sk_s1hat_get_poly	✅	3s	1s	+200%
unpack_sk_s2hat	✅	3s	2s	+50%
unpack_sk_t0hat	✅	3s	4s	-25%
yvec_init	✅	3s	3s	+0%
fqscale	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	1s	+100%
keccak_finalize	✅	2s	1s	+100%
keccak_init	✅	2s	2s	+0%
keccak_squeezeblocks_x4	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	3s	-33%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
make_hint	✅	2s	2s	+0%
mld_ct_abs_i32	✅	2s	4s	-50%
mld_ct_memcmp	✅	2s	4s	-50%
mld_prepare_domain_separation_prefix	✅	2s	3s	-33%
mld_value_barrier_i64	✅	2s	2s	+0%
ntt_native_x86_64	✅	2s	2s	+0%
nttunpack_native_x86_64	✅	2s	2s	+0%
pack_sig_c	✅	2s	3s	-33%
pack_sk_s1	✅	2s	4s	-50%
poly_chknorm_native_aarch64	✅	2s	5s	-60%
poly_invntt_tomont	✅	2s	4s	-50%
poly_ntt	✅	2s	7s	-71%
poly_shiftl	✅	2s	2s	+0%
poly_use_hint_c	✅	2s	2s	+0%
poly_use_hint_native	✅	2s	2s	+0%
polyveck_pack_eta	✅	2s	2s	+0%
polyveck_pack_w1	✅	2s	3s	-33%
polyvecl_pointwise_acc_montgomery	✅	2s	3s	-33%
polyvecl_pointwise_acc_montgomery_c	✅	2s	2s	+0%
polyvecl_uniform_gamma1_serial	✅	2s	2s	+0%
polyvecl_unpack_eta	✅	2s	2s	+0%
polyvecl_unpack_z	✅	2s	4s	-50%
polyw1_pack	✅	2s	4s	-50%
reduce32	✅	2s	4s	-50%
shake128x4_absorb_once	✅	2s	6s	-67%
shake256_init	✅	2s	4s	-50%
shake256_squeeze	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	3s	-33%
sig_unpack_hints	✅	2s	3s	-33%
sign_signature	✅	2s	3s	-33%
sign_signature_extmu	✅	2s	7s	-71%
sk_s2hat_get_poly	✅	2s	2s	+0%
sk_t0hat_get_poly	✅	2s	2s	+0%
unpack_pk_t1	✅	2s	2s	+0%
unpack_sk	✅	2s	4s	-50%
unpack_sk_s1hat	✅	2s	3s	-33%
caddq	✅	1s	5s	-80%
keccakf1600_xor_bytes	✅	1s	4s	-75%
keccakf1600x4_extract_bytes_native	✅	1s	3s	-67%
mld_ct_cmask_neg_i32	✅	1s	3s	-67%
mld_ct_get_optblocker_i64	✅	1s	3s	-67%
mld_ct_get_optblocker_u8	✅	1s	2s	-50%
mld_keccakf1600x4_xor_bytes_c	✅	1s	3s	-67%
montgomery_reduce	✅	1s	5s	-80%
pack_sig_h	✅	1s	6s	-83%
poly_uniform_gamma1_4x	✅	1s	4s	-75%
polyeta_pack	✅	1s	4s	-75%
polyvec_matrix_expand	✅	1s	4s	-75%
polyz_unpack_native	✅	1s	1s	+0%
yvec_get_poly	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (206 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1438s	1495s	-3.8%
polyvec_matrix_pointwise_montgomery_yvec	✅	189s	197s	-4%
poly_pointwise_montgomery_c	✅	121s	132s	-8%
mld_invntt_layer	✅	107s	113s	-5%
sign_verify_internal	✅	47s	47s	+0%
mld_ntt_layer	✅	43s	45s	-4%
fqmul	✅	40s	43s	-7%
polyvecl_chknorm	✅	35s	38s	-8%
mld_attempt_signature_generation	✅	26s	34s	-24%
keccakf1600x4_permute_native	✅	22s	24s	-8%
mld_ntt_butterfly_block	✅	22s	22s	+0%
poly_ntt_c	✅	21s	22s	-5%
mld_check_pct	✅	16s	14s	+14%
rej_uniform_c	✅	16s	17s	-6%
poly_uniform_eta_4x	✅	15s	13s	+15%
compute_pack_t0_t1	✅	13s	11s	+18%
polyeta_unpack	✅	13s	16s	-19%
polyt0_unpack	✅	13s	13s	+0%
poly_chknorm_c	✅	12s	13s	-8%
polyvec_matrix_pointwise_montgomery_row	✅	11s	14s	-21%
polyveck_caddq	✅	11s	8s	+38%
polyveck_decompose	✅	11s	13s	-15%
poly_invntt_tomont_c	✅	10s	14s	-29%
polyz_unpack_c	✅	10s	9s	+11%
rej_uniform	✅	10s	8s	+25%
keccak_absorb_once_x4	✅	9s	10s	-10%
mld_keccakf1600_permute_c	✅	9s	7s	+29%
polyveck_chknorm	✅	9s	10s	-10%
pointwise_acc_native_x86_64	✅	8s	8s	+0%
polyveck_reduce	✅	8s	9s	-11%
mld_sign_attempt	✅	7s	-	new
polyvecl_ntt	✅	7s	11s	-36%
sign_signature_internal	✅	7s	5s	+40%
mld_polymat_expand_entry	✅	6s	2s	+200%
mld_sample_s1_s2	✅	6s	5s	+20%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
poly_add	✅	6s	6s	+0%
poly_decompose_c	✅	6s	6s	+0%
polyveck_invntt_tomont	✅	6s	7s	-14%
polyz_unpack_19_native_aarch64	✅	6s	2s	+200%
rej_eta_native	✅	6s	5s	+20%
sign_keypair_internal	✅	6s	3s	+100%
sign_pk_from_sk	✅	6s	6s	+0%
intt_native_aarch64	✅	5s	4s	+25%
mld_compute_pack_z	✅	5s	5s	+0%
mld_h	✅	5s	6s	-17%
mld_sample_s1_s2_serial	✅	5s	5s	+0%
ntt_native_aarch64	✅	5s	3s	+67%
pack_sig_c	✅	5s	3s	+67%
poly_invntt_tomont_native	✅	5s	5s	+0%
poly_shiftl	✅	5s	2s	+150%
polyeta_pack	✅	5s	3s	+67%
polyveck_unpack_eta	✅	5s	3s	+67%
polyvecl_pointwise_acc_montgomery_c	✅	5s	2s	+150%
polyw1_pack_32	✅	5s	1s	+400%
rej_uniform_eta_native_aarch64	✅	5s	3s	+67%
sign_signature	✅	5s	5s	+0%
sign_signature_pre_hash_internal	✅	5s	2s	+150%
sign_verify_pre_hash_internal	✅	5s	5s	+0%
fqscale	✅	4s	1s	+300%
keccak_absorb	✅	4s	4s	+0%
keccak_f1600_x1_native_aarch64	✅	4s	3s	+33%
keccak_squeeze	✅	4s	3s	+33%
make_hint	✅	4s	1s	+300%
mld_ct_abs_i32	✅	4s	2s	+100%
mld_ct_sel_int32	✅	4s	3s	+33%
mld_prepare_domain_separation_prefix	✅	4s	2s	+100%
mld_sign_resume	✅	4s	-	new
montgomery_reduce	✅	4s	6s	-33%
pack_sk_s1	✅	4s	2s	+100%
pointwise_native_x86_64	✅	4s	4s	+0%
poly_chknorm	✅	4s	2s	+100%
poly_invntt_tomont	✅	4s	2s	+100%
poly_power2round	✅	4s	3s	+33%
poly_uniform	✅	4s	4s	+0%
poly_use_hint	✅	4s	3s	+33%
poly_use_hint_native	✅	4s	1s	+300%
polyvec_matrix_expand	✅	4s	3s	+33%
power2round	✅	4s	3s	+33%
shake128_release	✅	4s	2s	+100%
shake256_squeeze	✅	4s	2s	+100%
sign_signature_pre_hash_shake256	✅	4s	2s	+100%
sign_verify	✅	4s	6s	-33%
sk_t0hat_get_poly	✅	4s	3s	+33%
unpack_sk_s2hat	✅	4s	3s	+33%
unpack_sk_t0hat	✅	4s	4s	+0%
yvec_init	✅	4s	3s	+33%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	3s	+0%
keccak_f1600_x4_native_avx2	✅	3s	4s	-25%
keccak_init	✅	3s	2s	+50%
keccak_squeezeblocks_x4	✅	3s	5s	-40%
keccakf1600_extract_bytes (big endian)	✅	3s	2s	+50%
keccakf1600_permute	✅	3s	2s	+50%
keccakf1600x4_permute	✅	3s	4s	-25%
mld_ct_cmask_neg_i32	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u32	✅	3s	1s	+200%
mld_ct_get_optblocker_i64	✅	3s	2s	+50%
mld_keccakf1600x4_extract_bytes_c	✅	3s	3s	+0%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_i64	✅	3s	2s	+50%
ntt_native_x86_64	✅	3s	3s	+0%
nttunpack_native_x86_64	✅	3s	4s	-25%
pack_sig_h	✅	3s	4s	-25%
pointwise_native_aarch64	✅	3s	3s	+0%
poly_caddq_c	✅	3s	4s	-25%
poly_caddq_native	✅	3s	3s	+0%
poly_caddq_native_aarch64	✅	3s	5s	-40%
poly_caddq_native_x86_64	✅	3s	4s	-25%
poly_challenge	✅	3s	5s	-40%
poly_chknorm_native_aarch64	✅	3s	1s	+200%
poly_chknorm_native_x86_64	✅	3s	5s	-40%
poly_decompose_32_native_aarch64	✅	3s	2s	+50%
poly_decompose_88_native_aarch64	✅	3s	4s	-25%
poly_decompose_native	✅	3s	3s	+0%
poly_ntt	✅	3s	3s	+0%
poly_ntt_native	✅	3s	1s	+200%
poly_permute_bitrev_to_custom_optional	✅	3s	4s	-25%
poly_permute_bitrev_to_custom_optional_native	✅	3s	4s	-25%
poly_reduce	✅	3s	5s	-40%
poly_uniform_gamma1	✅	3s	2s	+50%
poly_uniform_gamma1_4x	✅	3s	3s	+0%
poly_use_hint_c	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyt1_pack	✅	3s	3s	+0%
polyt1_unpack	✅	3s	3s	+0%
polyveck_pack_w1	✅	3s	2s	+50%
polyvecl_pack_eta	✅	3s	1s	+200%
polyvecl_pointwise_acc_montgomery_native	✅	3s	3s	+0%
polyw1_pack_88	✅	3s	2s	+50%
polyz_unpack	✅	3s	2s	+50%
polyz_unpack_17_native_aarch64	✅	3s	2s	+50%
polyz_unpack_native_x86_64	✅	3s	2s	+50%
reduce32	✅	3s	2s	+50%
rej_eta_c	✅	3s	3s	+0%
rej_uniform_native_aarch64	✅	3s	5s	-40%
shake128_absorb	✅	3s	5s	-40%
shake128x4_absorb_once	✅	3s	2s	+50%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256_absorb	✅	3s	2s	+50%
shake256_finalize	✅	3s	3s	+0%
shake256x4_absorb_once	✅	3s	2s	+50%
sign_keypair	✅	3s	7s	-57%
sign_signature_extmu	✅	3s	3s	+0%
sign_verify_extmu	✅	3s	3s	+0%
sign_verify_pre_hash_shake256	✅	3s	4s	-25%
sys_check_capability	✅	3s	3s	+0%
caddq	✅	2s	5s	-60%
decompose	✅	2s	4s	-50%
intt_native_x86_64	✅	2s	2s	+0%
keccak_finalize	✅	2s	2s	+0%
keccakf1600_permute_native	✅	2s	6s	-67%
keccakf1600_xor_bytes	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	3s	-33%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
keccakf1600x4_xor_bytes_native	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_ct_get_optblocker_u32	✅	2s	1s	+100%
mld_ct_memcmp	✅	2s	4s	-50%
mld_value_barrier_u32	✅	2s	3s	-33%
mld_value_barrier_u8	✅	2s	1s	+100%
pack_sig_z	✅	2s	2s	+0%
pack_sk_rho_key_tr_s2	✅	2s	3s	-33%
poly_caddq	✅	2s	2s	+0%
poly_chknorm_native	✅	2s	3s	-33%
poly_decompose	✅	2s	4s	-50%
poly_pointwise_montgomery	✅	2s	5s	-60%
poly_pointwise_montgomery_native	✅	2s	4s	-50%
poly_sub	✅	2s	3s	-33%
poly_uniform_4x	✅	2s	2s	+0%
poly_uniform_eta	✅	2s	6s	-67%
polyt0_pack	✅	2s	4s	-50%
polyvec_matrix_expand_serial	✅	2s	2s	+0%
polyveck_ntt	✅	2s	2s	+0%
polyveck_pack_eta	✅	2s	5s	-60%
polyvecl_pointwise_acc_montgomery	✅	2s	3s	-33%
polyvecl_uniform_gamma1	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	4s	-50%
polyvecl_unpack_eta	✅	2s	7s	-71%
polyw1_pack	✅	2s	4s	-50%
polyz_pack	✅	2s	2s	+0%
polyz_unpack_native	✅	2s	2s	+0%
rej_eta	✅	2s	2s	+0%
rej_uniform_native	✅	2s	4s	-50%
shake128_squeeze	✅	2s	3s	-33%
shake256_init	✅	2s	2s	+0%
shake256_release	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	5s	-60%
sig_unpack_hints	✅	2s	3s	-33%
sk_s2hat_get_poly	✅	2s	5s	-60%
unpack_sk	✅	2s	4s	-50%
use_hint	✅	2s	2s	+0%
yvec_get_poly	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	2s	-50%
mld_ct_get_optblocker_u8	✅	1s	3s	-67%
mld_keccakf1600_extract_bytes	✅	1s	4s	-75%
mld_keccakf1600x4_xor_bytes_c	✅	1s	4s	-75%
polyvecl_unpack_z	✅	1s	4s	-75%
shake128_finalize	✅	1s	2s	-50%
shake128_init	✅	1s	4s	-75%
shake256	✅	1s	6s	-83%
sk_s1hat_get_poly	✅	1s	3s	-67%
unpack_pk_t1	✅	1s	3s	-67%
unpack_sk_s1hat	✅	1s	3s	-67%